Cross-Site Scripting (XSS) in jquery

Description

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain the dataType option.

Recommendation

Update the jquery package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.12.3, < 3.0.0

  < 1.12.2**

• Patched version(s): **3.0.0

  1.12.2**

References

• GHSA-rmxg-73gg-4p98
• access.redhat.com
• ics-cert.us-cert.gov
• kb.pulsesecure.net
• lists.apache.org
• seclists.org
• security.netapp.com
• snyk.io
• sw.aveva.com
• www.oracle.com
• www.tenable.com
• lists.opensuse.org
• packetstormsecurity.com
• security.snyk.io
• web.archive.org
• CVE-2015-9251
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jQuery vulnerable to Cross-Site Scripting (XSS) - CVE-2011-4969
• Cross-Site Scripting in handlebars - CVE-2015-8861
• Cross-Site Scripting in jquery - jquery - CVE-2012-6708
• CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

jquery